getreadystack commited on
Commit
ec9f363
·
verified ·
1 Parent(s): 6f101b1

Upload index.html with huggingface_hub

Browse files
Files changed (1) hide show
  1. index.html +80 -18
index.html CHANGED
@@ -1,19 +1,81 @@
1
- <!doctype html>
2
- <html>
3
- <head>
4
- <meta charset="utf-8" />
5
- <meta name="viewport" content="width=device-width" />
6
- <title>My static Space</title>
7
- <link rel="stylesheet" href="style.css" />
8
- </head>
9
- <body>
10
- <div class="card">
11
- <h1>Welcome to your static Space!</h1>
12
- <p>You can modify this app directly by editing <i>index.html</i> in the Files and versions tab.</p>
13
- <p>
14
- Also don't forget to check the
15
- <a href="https://huggingface.co/docs/hub/spaces" target="_blank">Spaces documentation</a>.
16
- </p>
17
- </div>
18
- </body>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
19
  </html>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ <!doctype html><html lang="en"><meta charset="utf-8">
2
+ <meta name="viewport" content="width=device-width,initial-scale=1">
3
+ <title>PCI DSS 6.4.3 Payment Page Script Inventory Auditor</title>
4
+ <meta name="description" content="Lists every script on your checkout page that has no integrity hash, no authorisation and no written justification - the three things PCI DSS 6.4.3 has required since 31 March 2025.">
5
+ <script defer data-auto-init src="https://cdn.jsdelivr.net/npm/@polar-sh/checkout@latest/dist/embed.global.js"></script>
6
+ <style>
7
+ :root{color-scheme:light dark}
8
+ body{margin:0;font:16px/1.6 system-ui,-apple-system,"Segoe UI",sans-serif;
9
+ background:#fbfbfa;color:#16161d}
10
+ @media(prefers-color-scheme:dark){body{background:#14141a;color:#e8e8ea}}
11
+ .wrap{max-width:880px;margin:0 auto;padding:28px 20px 64px}
12
+ h1{font-size:1.7rem;line-height:1.25;margin:.2em 0 .3em}
13
+ p.sub{margin:0 0 1.4em;opacity:.8}
14
+ textarea{width:100%;min-height:230px;font:13px/1.5 ui-monospace,Menlo,Consolas,monospace;
15
+ padding:12px;border:1px solid #c9c9d1;border-radius:10px;background:transparent;color:inherit;
16
+ box-sizing:border-box}
17
+ button{font:600 15px/1 inherit;padding:12px 22px;border:0;border-radius:10px;
18
+ background:#1d4ed8;color:#fff;cursor:pointer;margin:12px 0}
19
+ button:hover{background:#1a43bd}
20
+ table{border-collapse:collapse;width:100%;margin-top:14px;font-size:14px}
21
+ th,td{border-bottom:1px solid #d8d8e0;padding:8px 6px;text-align:left;vertical-align:top}
22
+ th{font-weight:600;opacity:.75}
23
+ td.n{width:64px;font:13px ui-monospace,monospace;opacity:.7}
24
+ .ok{padding:14px;border-radius:10px;background:#e8f5ec;color:#14532d;margin-top:14px}
25
+ @media(prefers-color-scheme:dark){.ok{background:#15321f;color:#bbf7d0}}
26
+ .next{margin-top:30px;padding:18px;border:1px solid #d8d8e0;border-radius:12px}
27
+ .next h2{font-size:1.05rem;margin:0 0 .5em}
28
+ .cta{margin-top:18px;padding:16px 18px;border:1px solid #1d4ed8;border-radius:12px}
29
+ .cta p{margin:0 0 .6em}
30
+ .cta a.buy{display:inline-block;font:600 15px/1 inherit;padding:12px 22px;border-radius:10px;background:#1d4ed8;color:#fff;text-decoration:none}
31
+ .cta p.terms{margin:.8em 0 0;font-size:13px;opacity:.75}
32
+ .next ul{margin:.3em 0 1em 1.1em;padding:0}
33
+ </style>
34
+ <div class="wrap">
35
+ <h1>PCI DSS 6.4.3 Payment Page Script Inventory Auditor</h1>
36
+ <p class="sub">Lists every script on your checkout page that has no integrity hash, no authorisation and no written justification - the three things PCI DSS 6.4.3 has required since 31 March 2025.</p>
37
+ <textarea id="src" placeholder="Paste your checkout page HTML, or the template that renders it, here"></textarea>
38
+ <button id="go">Audit this payment page</button>
39
+ <div id="out"></div>
40
+ <div class="yj-home-find"><div class="yj-lgbar"><a href="/" class="yj-lg on">EN</a><a href="/de/" class="yj-lg">DE</a><a href="/ja/" class="yj-lg">JA</a><a href="/es/" class="yj-lg">ES</a><a href="/pt/" class="yj-lg">PT</a></div><section class="yj-find"><h2>Find a tool</h2><input id="yjq" type="search" autocomplete="off" placeholder="Type a product name, format or task"><div id="yjr"></div></section><style>.yj-lgbar{position:absolute;top:14px;right:18px;display:flex;gap:6px;z-index:60}.yj-lg{font:600 12px/1 system-ui,sans-serif;padding:6px 9px;border-radius:4px;text-decoration:none;color:#8b96a3;border:1px solid rgba(140,150,165,.28)}.yj-lg:hover{color:#e8eaed;border-color:rgba(160,175,195,.6)}.yj-lg.on{color:#0e1116;background:#cfd6de;border-color:#cfd6de}.yj-find{max-width:760px;margin:34px auto 8px;padding:0 20px}.yj-find h2{font:600 20px/1.3 system-ui,sans-serif;margin:0 0 10px}#yjq{width:100%;box-sizing:border-box;padding:13px 15px;font:400 15.5px system-ui,sans-serif;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:rgba(255,255,255,.04);color:inherit}#yjq:focus{outline:none;border-color:#7FD1C4}#yjr{margin-top:10px;display:flex;flex-direction:column;gap:6px}#yjr a{display:flex;justify-content:space-between;gap:12px;padding:11px 14px;border:1px solid rgba(140,150,165,.22);border-radius:6px;text-decoration:none;font:400 14.5px/1.4 system-ui,sans-serif;color:inherit}#yjr a:hover{border-color:#7FD1C4}#yjr .pr{font:600 13px system-ui,sans-serif;color:#5fbf9a;white-space:nowrap}</style><script>(function(){var q=document.getElementById("yjq"),r=document.getElementById("yjr"),D=null;function load(){if(D)return Promise.resolve(D);return fetch("/search-index.json").then(function(x){return x.json();}).then(function(j){D=j;return j;}).catch(function(){D=[];return D;});}function esc(t){return String(t).replace(/[&<>"]/g,function(c){return {"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"}[c];});}function run(){var v=q.value.trim().toLowerCase();if(v.length<2){r.innerHTML="";return;}load().then(function(j){var w=v.split(/\s+/),o=[];for(var i=0;i<j.length&&o.length<12;i++){var t=j[i].t.toLowerCase();var ok=true;for(var k=0;k<w.length;k++){if(t.indexOf(w[k])<0){ok=false;break;}}if(ok)o.push(j[i]);}r.innerHTML=o.length?o.map(function(x){return "<a href=\""+esc(x.u)+"\">"+"<span>"+esc(x.t)+"</span>"+(x.p?"<span class=\"pr\">$"+x.p+"</span>":"")+"</a>";}).join(""):"";});}q.addEventListener("input",run);q.addEventListener("focus",load);})();</script></div><div class="cta" id="cta" hidden><p>PCI 11.6.1 asks for this check at least once every seven days, on every payment page, with a record kept. The full version scans the whole repository and writes the inventory to CSV, JSON or HTML.</p>
41
+ <a href="https://buy.polar.sh/polar_cl_3JweRl77lj7Lnb2RWmPjP2DpCF71WE5AcU4xO1lrAFh" data-polar-checkout data-polar-checkout-theme="light" class="buy">Get the full version - $29</a>
42
+ <p class="terms">$29 once · one licence key per person or team seat · 7-day full refund. Hosted payment-page script-monitoring services run $99-$999 per month for small businesses.</p></div>
43
+ <div class="next"><h2>In the full version</h2><ul><li>Scan every template in the repository, not only the file that is open</li><li>Write the script inventory out as CSV, JSON or HTML</li><li>Machine-readable output so the check can run in CI</li><li><a href="https://buy.polar.sh/polar_cl_3JweRl77lj7Lnb2RWmPjP2DpCF71WE5AcU4xO1lrAFh">Get the full version</a></li></ul></div>
44
+ </div>
45
+ <script>
46
+ var RULES=[{"pattern": "<script(?=[^>]*\\ssrc=[\"\\']https?://)(?![^>]*\\sintegrity=)[^>]*>", "flags": "i", "sev": "error", "message": "6.4.3 integrity: third-party script loaded with no integrity attribute. Nothing assures this file is the file you reviewed. Add an SRI hash (integrity=\"sha384-...\") or self-host it.", "fix": "add integrity=\"sha384-...\" crossorigin=\"anonymous\""}, {"pattern": "<script(?=[^>]*\\sintegrity=)(?=[^>]*\\ssrc=[\"\\']https?://)(?![^>]*\\scrossorigin)[^>]*>", "flags": "i", "sev": "error", "message": "6.4.3 integrity: the integrity attribute is IGNORED on a cross-origin script that has no crossorigin attribute. The SRI hash here is decorative - the browser does not enforce it.", "fix": "add crossorigin=\"anonymous\""}, {"pattern": "integrity=[\"\\'](?:sha1|md5)-", "flags": "i", "sev": "error", "message": "6.4.3 integrity: sha1/md5 is not a valid SRI algorithm. Browsers reject the attribute and load the script unchecked. SRI accepts sha256, sha384 or sha512 only.", "fix": "use sha384"}, {"pattern": "integrity=[\"\\']\\s*[\"\\']", "flags": "i", "sev": "error", "message": "6.4.3 integrity: empty integrity attribute. It reads as if SRI is in place while nothing at all is verified."}, {"pattern": "<script[^>]+src=[\"\\']http://", "flags": "i", "sev": "error", "message": "6.4.3 integrity: script fetched over plain http on a payment page. It can be rewritten in transit, so its integrity is not assured, and browsers block it as mixed content."}, {"pattern": "<link(?=[^>]*rel=[\"\\'](?:preload|modulepreload)[\"\\'])(?=[^>]*\\sas=[\"\\']script[\"\\'])(?![^>]*\\sintegrity=)[^>]*>", "flags": "i", "sev": "warn", "message": "6.4.3 inventory: a preloaded script with no integrity attribute. It is easy to miss because it is a <link>, not a <script>, but it is executed like any other script."}, {"pattern": "<script[^>]+src=[\"\\'][^\"\\']*(?:@latest|/latest/|/master/|/main/|\\?ver=)", "flags": "i", "sev": "error", "message": "6.4.3 authorisation: script pinned to a moving target (@latest, /main/, ?ver=). The file can change without you changing anything, so neither the authorisation nor the inventory stays true.", "fix": "pin an exact version"}, {"pattern": "<script(?![^>]*\\ssrc=)(?![^>]*\\snonce=)(?![^>]*\\stype=[\"\\'](?:application/json|application/ld\\+json|text/template))[^>]*>", "flags": "i", "sev": "warn", "message": "6.4.3 authorisation: inline script with no nonce. A CSP allowlist cannot cover it, so no method confirms it is the authorised script rather than an injected one."}, {"pattern": "script-src[^;\"]*'unsafe-inline'", "flags": "i", "sev": "error", "message": "6.4.3 authorisation: CSP script-src allows 'unsafe-inline', which authorises any inline script an attacker manages to inject. The control 6.4.3 leans on is switched off."}, {"pattern": "script-src[^;\"]*'unsafe-eval'", "flags": "i", "sev": "warn", "message": "6.4.3 authorisation: CSP script-src allows 'unsafe-eval', so authorised script can still execute strings that were never reviewed."}, {"pattern": "script-src[^;\"]*\\*", "flags": "i", "sev": "error", "message": "6.4.3 authorisation: CSP script-src contains a wildcard, so any host may serve script to the payment page. A wildcard is not a method of confirming each script is authorised."}, {"pattern": "Content-Security-Policy-Report-Only", "flags": "i", "sev": "warn", "message": "6.4.3 authorisation: this CSP is report-only. It records violations and blocks nothing, so on its own it is not an authorisation method."}, {"pattern": "<base[^>]+href=", "flags": "i", "sev": "warn", "message": "6.4.3 inventory: a <base> tag repoints every relative script URL on the page, so the script that actually loads may not be the script listed in your inventory."}, {"pattern": "googletagmanager\\.com|/gtm\\.js|/gtag/js", "flags": "i", "sev": "error", "message": "6.4.3 inventory: a tag manager on a payment page injects further scripts at run time, so a source-level inventory can never be complete. PCI guidance is to keep tag managers off the payment page."}, {"pattern": "hotjar|fullstory|mouseflow|clarity\\.ms|luckyorange|smartlook|logrocket|sessioncam", "flags": "i", "sev": "error", "message": "6.4.3 justification: a session-recording script on a payment page can capture card fields as they are typed. This is a standard assessor finding and needs a written justification, or removal."}, {"pattern": "createElement\\(\\s*[\"\\']script[\"\\']", "flags": "i", "sev": "warn", "message": "6.4.3 inventory: a script element built at run time never appears in the page source, so it is invisible to a source-level inventory unless you add it by hand."}, {"pattern": "document\\.write\\s*\\(", "flags": "i", "sev": "warn", "message": "6.4.3 inventory: document.write on a payment page can inject unreviewed markup and script after load, defeating the inventory."}, {"pattern": "\\beval\\s*\\(|new\\s+Function\\s*\\(", "flags": "", "sev": "error", "message": "6.4.3 integrity: code built and executed from a string on a payment page is in no inventory and carries no integrity check."}, {"pattern": "serviceWorker\\.register\\s*\\(", "flags": "", "sev": "warn", "message": "11.6.1 tamper detection: a service worker can rewrite the payment page after it was served. That is precisely the change 11.6.1 exists to detect, so it needs a justification and monitoring."}, {"pattern": "postMessage\\([^)]*,\\s*[\"\\']\\*[\"\\']", "flags": "", "sev": "warn", "message": "Payment page: postMessage with a \"*\" target origin will deliver its data to any frame on the page, including one that was injected."}, {"pattern": "<input[^>]+(?:name|id)=[\"\\'][^\"\\']*(?:cardnumber|card_number|card-number|cc-?num|creditcard|\\bpan\\b|cvv|cvc|securitycode|security-code|expiry|exp-?date)", "flags": "i", "sev": "error", "message": "SAQ eligibility: a card-data field is served by your own page. SAQ A eligibility requires ALL card fields to come from the payment provider (iframe or redirect), so SAQ A-EP or SAQ D applies and 6.4.3 and 11.6.1 apply in full."}, {"pattern": "<iframe[^>]+src=[\"\\'][^\"\\']*(?:js\\.stripe\\.com|checkout\\.stripe\\.com|adyen|braintree|paypal|worldpay|squareup|checkout\\.)", "flags": "i", "sev": "info", "message": "Hosted payment iframe found. Useful, but note 6.4.3 covers the page that HOSTS the iframe, not only the iframe: every script on this page is still in scope."}];
47
+ function scan(t){var L=String(t).split(/\r?\n/),h=[],i,r,re;
48
+ for(i=0;i<L.length;i++){for(var k=0;k<RULES.length;k++){r=RULES[k];
49
+ try{re=new RegExp(r.pattern,r.flags||'')}catch(e){continue}
50
+ if(re.test(L[i]))h.push({line:i+1,msg:r.message})}}
51
+ return h}
52
+ document.getElementById('go').onclick=function(){
53
+ var t=document.getElementById('src').value,o=document.getElementById('out');
54
+ if(!t.trim()){o.innerHTML='';return}
55
+ var h=scan(t),c=document.getElementById('cta');
56
+ if(c)c.hidden=false;
57
+ if(!h.length){o.innerHTML='<div class="ok">No payment-page script findings in this file. This reads the page source, so it cannot see scripts a tag manager injects at run time.</div>';return}
58
+ var s='<table><tr><th>Line</th><th>Finding</th></tr>';
59
+ for(var i=0;i<h.length;i++){s+='<tr><td class="n">'+h[i].line+'</td><td>'+
60
+ String(h[i].msg).replace(/&/g,'&amp;').replace(/</g,'&lt;')+'</td></tr>'}
61
+ o.innerHTML=s+'</table>'};
62
+ </script>
63
  </html>
64
+
65
+ <section data-yj-alert="rule" style="margin:1rem auto 1.5rem;max-width:46rem;padding:1.1rem 1.25rem;border:1px solid #d9dee6;border-radius:12px;background:#fbfcfd;font:15px/1.55 system-ui,-apple-system,Segoe UI,sans-serif"><b style="font-size:1.05rem">Get one email when this rule changes</b><div style="opacity:.78;margin:.35rem 0 .8rem">We watch the regulation and vendor sources behind PCI DSS 6.4.3 Payment Page Script Inventory Auditor every day. When a rule changes, you get a single email with what changed and the updated check. No newsletter.</div><div style="display:flex;gap:8px;flex-wrap:wrap"><input id="yjae" type="email" placeholder="you@example.com" style="flex:1;min-width:210px;padding:11px 13px;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:#fff;color:inherit"><button id="yjab" style="padding:11px 18px;border-radius:8px;border:0;cursor:pointer;background:#0f7b3f;color:#fff;font:600 15px system-ui,sans-serif">Notify me</button></div><div id="yjao" hidden style="margin-top:.6rem;color:#0f7b3f">You're on the list. One email when it changes.</div><script>(function(){var b=document.getElementById("yjab"),e=document.getElementById("yjae");if(!b||!e)return;b.addEventListener("click",function(){var v=e.value.trim();if(!/.+@.+\..+/.test(v))return;try{localStorage.setItem("yj_em","1");}catch(_){}fetch(location.origin+"/api/subscribe",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:v,slug:"payment-page-script-audit",lang:"en",source:"rule_alert"})}).then(function(r){var o=document.getElementById("yjao");o.hidden=false;if(!r.ok){o.textContent="Could not save - please try again.";}}).catch(function(){var o=document.getElementById("yjao");o.hidden=false;o.textContent="Could not save - please try again.";});});})();</script></section>
66
+
67
+
68
+ <section data-yj-install="free" style="margin:2rem auto 1rem;max-width:46rem;padding:1.25rem 1.25rem;border:1px solid #cfe3d6;border-radius:12px;background:#f6fbf8;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .4rem;font-size:1.2rem">Install free</h2><p style="margin:0 0 .8rem;color:#41505f">Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.</p><a href="https://www.npmjs.com/package/@readystack/payment-page-script-audit" rel="noopener" data-yj-install-door="npm" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'payment-page-script-audit',src:'npm',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">npm</a><a href="https://hub.docker.com/r/getreadystack/payment-page-script-audit" rel="noopener" data-yj-install-door="docker" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'payment-page-script-audit',src:'docker',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">Docker Hub</a><pre style="margin:.5rem 0 0;padding:.6rem .8rem;background:#f3f5f8;border-radius:8px;font-size:.9rem;overflow:auto">npx @readystack/payment-page-script-audit &lt;file&gt;
69
+ docker run --rm -v &quot;$PWD:/w&quot; getreadystack/payment-page-script-audit /w</pre><p style="margin:.6rem 0 0;font-size:.92rem;color:#41505f"><a href="https://buy.polar.sh/polar_cl_l6iN1uWt0FwWu7tBsczD0jWpP2vxFM54Wdwqb3KPi1G" rel="nofollow" style="color:#0f7b3f;text-decoration:underline">Team? One key for every ReadyStack linter, 5 seats, $149 once</a></p></section>
70
+ <section data-yj-cta="paid" style="margin:3rem auto;max-width:46rem;padding:1.5rem 1.25rem;border:1px solid #d8dee9;border-radius:12px;background:#fbfcfe;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .5rem;font-size:1.25rem">Get the complete version <span class="yj-price">$29</span></h2><p style="margin:.25rem 0 1rem;color:#41505f">This page is the working piece. The full pack has everything below.</p><p style="margin:0 0 1rem;color:#41505f">Lists every script on your checkout page that has no integrity hash, no authorisation and no written justification - the three things PCI DSS 6.4.3 has required since 31 March 2025.</p><p style="margin:0 0 1rem;color:#5b6b7c;font-size:.94rem">Hosted payment-page script-monitoring services run $99-$999 per month for small businesses.</p><a href="https://buy.polar.sh/polar_cl_3JweRl77lj7Lnb2RWmPjP2DpCF71WE5AcU4xO1lrAFh" rel="nofollow" style="display:inline-block;padding:.7rem 1.3rem;border-radius:8px;background:#1b64f2;color:#fff;text-decoration:none;font-weight:600">Buy the full version — $29</a></section>
71
+ <!--yj-share-s101--><div style="margin:28px 0 8px;text-align:center"><button id="yjcp" type="button" style="font:inherit;padding:10px 18px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Copy link</button><button id="yjimg" type="button" style="font:inherit;padding:10px 18px;margin-left:8px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Save result as image</button></div><script>(function(){var b=document.getElementById("yjimg");if(!b)return;b.addEventListener("click",function(){var o=document.getElementById("out");var txt=(o&&(o.innerText||o.textContent)||"").trim();if(!txt){b.textContent="(no result yet)";setTimeout(function(){b.textContent="Save result as image";},1500);return;}var lines=txt.split(String.fromCharCode(10)).filter(function(x){return x.trim();}).slice(0,10);var W=1200,P=56,c=document.createElement("canvas");c.width=W;var lh=38,H=P*2+70+lines.length*lh+60;c.height=H;var x=c.getContext("2d");x.fillStyle="#1a1512";x.fillRect(0,0,W,H);x.fillStyle="#f3e9d2";x.font="600 34px system-ui,Segoe UI,Arial";var t=(document.title||"").split("|")[0].trim();x.fillText(t.slice(0,54),P,P+34);x.font="22px ui-monospace,Menlo,Consolas,monospace";x.fillStyle="#e8dcc4";for(var i=0;i<lines.length;i++){x.fillText(lines[i].slice(0,88),P,P+70+i*lh+22);}x.font="600 22px system-ui,Segoe UI,Arial";x.fillStyle="#c9a227";var d=location.hostname.replace("www.","");x.fillText(d,W-P-x.measureText(d).width,H-P+6);c.toBlob(function(bl){var u=URL.createObjectURL(bl),a=document.createElement("a");a.href=u;a.download=(t||"result").replace(/[^a-z0-9]+/gi,"-").toLowerCase()+"-"+d+".png";document.body.appendChild(a);a.click();setTimeout(function(){URL.revokeObjectURL(u);a.remove();},2000);},"image/png");});})();</script><script>(function(){var b=document.getElementById("yjcp");if(!b)return;var t=b.textContent;b.addEventListener("click",function(){var u=location.href.split("#")[0];function d(){b.textContent="Link copied";setTimeout(function(){b.textContent=t;},1800);}if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(u).then(d,function(){prompt("",u);});}else{prompt("",u);}});})();</script><section data-yj="yj-facts-v1" style="max-width:920px;margin:48px auto 0;padding:0 20px;font-family:system-ui,sans-serif"><style>.yj-article p{font:400 15.5px/1.7 system-ui,sans-serif;color:#26313b;margin:0 0 12px;max-width:72ch}.yj-article h2,.yj-article h3,.yj-article h4{font:600 17px/1.35 system-ui,sans-serif;color:#1b1f24;margin:22px 0 8px}.yj-article table{border-collapse:collapse;margin:10px 0 16px;font:14px/1.45 system-ui,sans-serif}.yj-article th,.yj-article td{border:1px solid #e2e6ea;padding:6px 10px;text-align:left}.yj-article th{background:#f4f6f8}.yj-article pre{background:#0f1720;color:#e6edf3;padding:12px 14px;border-radius:8px;overflow:auto;font:13px/1.5 ui-monospace,Menlo,monospace}.yj-article code{font:13px ui-monospace,Menlo,monospace;background:#f1f3f5;padding:1px 4px;border-radius:3px}.yj-article pre code{background:none;padding:0}.yj-article ul,.yj-article ol{font:15px/1.6 system-ui,sans-serif;color:#26313b}</style><p style="font:400 13px/1.5 system-ui,sans-serif;color:#6b7680;margin:0 0 14px"><time datetime="2026-09-09">Updated 2026-09-09</time> · ReadyStack</p><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","dateModified":"2026-09-09","author":{"@type":"Organization","name":"ReadyStack"}}</script><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Worked example</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 16px;color:#5b6570">Real numbers from this tool, line by line.</p><div class="yj-article"><p><img src="https://getreadystack.com/img/promo/sku20312_result_card.jpg" alt="PCI DSS 6.4.3 Payment Page Script Inventory Auditor" loading="lazy" style="max-width:100%;border-radius:6px"></p>
72
+ <p>Five lines in a Shopify checkout template were enough to put a UK merchant outside PCI DSS 6.4.3 - and every one of them had been sitting there, reviewed and approved, since before the requirement bit.</p>
73
+ <p>Since 31 March 2025 requirements 6.4.3 and 11.6.1 of PCI DSS v4.0.1 are no longer future-dated. 6.4.3 says that every script loaded and executed in the consumer&#x27;s browser on a payment page must be authorised by some method, have its integrity assured by some method, and appear in an inventory with a written justification for why it is needed. 11.6.1 says a change- and tamper-detection mechanism must alert someone to unauthorised modification of the payment page and its HTTP headers, and must run at least once every seven days.</p>
74
+ <p>The five lines were ordinary. A tag manager, because marketing wanted it. A session-recording script, because support wanted it. A CDN script pinned to @latest, because that is what the docs showed. An integrity hash with no crossorigin attribute - which browsers silently ignore, so the hash was decorative. And one card input rendered by the store&#x27;s own template rather than the provider&#x27;s iframe.</p>
75
+ <p>That last one is the expensive line. SAQ A eligibility requires that all card fields come from the payment provider. One field of your own and SAQ A-EP or SAQ D applies instead, which brings 6.4.3 and 11.6.1 back in full. This is also the point most answers get wrong in both directions: the Council removed 6.4.3 and 11.6.1 from SAQ A on 31 March 2025 and replaced them with an eligibility criterion, which is not the same thing as an exemption.</p>
76
+ <p>None of the five needed a scanner to find. They needed someone to look at the template with the three bullets of 6.4.3 in hand. That is what this extension does: it reads the page source you already have open and lists what fails, with line numbers, before your acquirer&#x27;s questionnaire does it for you.</p></div><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:34px 0 6px;color:#1b1f24">Questions people ask</h2><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What does this actually do?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">It reads a checkout page or the template that renders it and lists every script PCI DSS 6.4.3 would flag: no integrity hash, an unenforced hash, a moving version pin, a tag manager that injects scripts you never see, or a card field that changes which SAQ you qualify for. Each finding cites its line.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Who is it for?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Developers who own an ecommerce checkout page and have to answer their acquirer&#x27;s self-assessment questionnaire. It is aimed at the person who actually edits the template, not at a compliance officer: findings arrive as line numbers in the editor, and the wording explains which of the three 6.4.3 bullets each one breaks.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why will a free linter not do?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">General linters and CSP checkers test web hygiene, not this requirement. They will not tell you that an integrity attribute is ignored without crossorigin, that a tag manager makes a script inventory impossible to complete, or that one card input on your own page moves you off SAQ A eligibility entirely.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What is free and what needs a licence?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Free checks the file you have open, or just the lines you select, against all 22 rules and shows every finding with its line number. That finishes the job for one page. The licence adds the repeat: a scan of every template in the repository, the inventory written out as a file, and CI output.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What does the alternative cost?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Hosted payment-page script-monitoring services run $99 to $999 per month for small businesses, and a single QSA hour costs more than this extension. This is $29 once. It does not replace a monitoring service for the weekly 11.6.1 check on live traffic; it removes the findings before they reach either.</p></details><script type="application/ld+json" data-yj="yj-faq-ld">{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "What does this actually do?", "acceptedAnswer": {"@type": "Answer", "text": "It reads a checkout page or the template that renders it and lists every script PCI DSS 6.4.3 would flag: no integrity hash, an unenforced hash, a moving version pin, a tag manager that injects scripts you never see, or a card field that changes which SAQ you qualify for. Each finding cites its line."}}, {"@type": "Question", "name": "Who is it for?", "acceptedAnswer": {"@type": "Answer", "text": "Developers who own an ecommerce checkout page and have to answer their acquirer's self-assessment questionnaire. It is aimed at the person who actually edits the template, not at a compliance officer: findings arrive as line numbers in the editor, and the wording explains which of the three 6.4.3 bullets each one breaks."}}, {"@type": "Question", "name": "Why will a free linter not do?", "acceptedAnswer": {"@type": "Answer", "text": "General linters and CSP checkers test web hygiene, not this requirement. They will not tell you that an integrity attribute is ignored without crossorigin, that a tag manager makes a script inventory impossible to complete, or that one card input on your own page moves you off SAQ A eligibility entirely."}}, {"@type": "Question", "name": "What is free and what needs a licence?", "acceptedAnswer": {"@type": "Answer", "text": "Free checks the file you have open, or just the lines you select, against all 22 rules and shows every finding with its line number. That finishes the job for one page. The licence adds the repeat: a scan of every template in the repository, the inventory written out as a file, and CI output."}}, {"@type": "Question", "name": "What does the alternative cost?", "acceptedAnswer": {"@type": "Answer", "text": "Hosted payment-page script-monitoring services run $99 to $999 per month for small businesses, and a single QSA hour costs more than this extension. This is $29 once. It does not replace a monitoring service for the weekly 11.6.1 check on live traffic; it removes the findings before they reach either."}}]}</script><div id="yj-ask" style="margin:36px 0 0;padding:18px 18px 16px;border:1px solid #e2e6ea;border-radius:10px;background:#fbfbfc"><h2 style="font:600 19px/1.3 system-ui,sans-serif;margin:0 0 4px;color:#1b1f24">Ask about this tool</h2><p style="font:400 13.5px/1.5 system-ui,sans-serif;margin:0 0 12px;color:#5b6570">One question, answered by the person who built it. Your email only if you want the answer sent.</p><form onsubmit="return yjAsk(event)" style="display:grid;gap:8px"><textarea name="question" required minlength="10" maxlength="2000" rows="3" placeholder="Your question" style="font:14px/1.5 system-ui,sans-serif;padding:10px;border:1px solid #cfd6dd;border-radius:6px"></textarea><div style="display:flex;gap:8px;flex-wrap:wrap"><input type="email" name="email" placeholder="Email (optional)" style="flex:1;min-width:200px;font:14px system-ui,sans-serif;padding:9px 10px;border:1px solid #cfd6dd;border-radius:6px"><button type="submit" style="font:600 14px system-ui,sans-serif;padding:9px 18px;border:0;border-radius:6px;background:#1b1f24;color:#fff;cursor:pointer">Send</button></div><p id="yj-ask-msg" style="font:13px system-ui,sans-serif;margin:2px 0 0;color:#0a6238;min-height:1em"></p></form><script>function yjAsk(e){e.preventDefault();var f=e.target,m=document.getElementById("yj-ask-msg");m.style.color="#0a6238";fetch(location.origin+"/api/ask",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({sku:20312,slug:"payment-page-script-audit",lang:"en",question:f.question.value,email:f.email.value,page:location.pathname})}).then(function(r){if(!r.ok)throw 0;m.textContent="Thanks \u2014 noted. Answers land on this page and, if you left an email, in your inbox.";f.question.value="";}).catch(function(){m.style.color="#a8551f";m.textContent="Could not send. Please try again in a minute.";});return false;}</script></div></section><section class="yj-related" style="max-width:920px;margin:56px auto 40px;padding:0 20px"><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Same job, next tool</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 20px;color:#5b6570">Free in the browser. The full version is a one-time licence, 7-day refund.</p><div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(250px,1fr));gap:14px"><a class="yj-rel-c" href="https://getreadystack.com/tools/pci-payment-page-script-lint"><span class="yj-rel-t">PCI DSS 6.4.3 Payment Page Script Lint</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/pci-payment-page-script-audit"><span class="yj-rel-t">PCI Payment Page Script Audit: requirement 6.4.3 and 11.6.1 on your checkout m</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/personal-data-map-dsar-audit"><span class="yj-rel-t">Personal Data Map: find every column a GDPR subject access request has to reac</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/about-page-template"><span class="yj-rel-t">About Page Template — 6 Finished About Pages for Small Service Businesses (Sel</span><span class="yj-rel-p">$49</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/ecommerce-icon-pack"><span class="yj-rel-t">Ecommerce Icon Pack UI Kit — Cart, Checkout &amp; Order-Status Components in 32 St</span><span class="yj-rel-p">$168</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/landing-page-template"><span class="yj-rel-t">Landing Page Template — 8 Ready-Written Pages for an Online Course Launch (Pla</span><span class="yj-rel-p">$49</span></a></div><style>.yj-rel-c{display:flex;flex-direction:column;gap:8px;padding:15px 16px;border:1px solid #e2e6ea;border-radius:6px;text-decoration:none;background:#fff}.yj-rel-c:hover{border-color:#b9c2cb;background:#fafbfc}.yj-rel-t{font:500 14.5px/1.42 system-ui,sans-serif;color:#1b1f24}.yj-rel-p{font:600 13px system-ui,sans-serif;color:#0a6238}</style></section>
77
+
78
+
79
+ <script data-yj="yj-view-beacon">(function(){try{var p=location.pathname;var k='yjv:'+p;if(sessionStorage.getItem(k))return;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",ref:(document.referrer||''),src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}catch(e){}})();</script>
80
+
81
+ <script data-yj="yj-use-beacon">(function(){try{var o=document.getElementById('out');if(!o)return;var p=location.pathname,k='yju:'+p,sent=false;function fire(){if(sent||sessionStorage.getItem(k))return;if(!(o.textContent||'').replace(/\s+/g,'').length)return;sent=true;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",t:'use',src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}var mo=new MutationObserver(function(){fire();if(sent)mo.disconnect();});mo.observe(o,{childList:true,characterData:true,subtree:true});}catch(e){}})();</script>